Chapter 5 - Examining Brexit: The rise and fall of a Twitter botnet

The referendum on the UK’s membership in the European Union was held against a backdrop of political realignment, polarisation, and hyperpartisanship. Additionally, news readership mirrored a demographic splintering, dividing news consumption along broadsheet and tabloid media outlets. Those elements were strategically leveraged and maximised by populist parties and leaders during the referendum in order to promote “traditional cultural values and emphasize nationalistic and xenophobia appeals, rejecting outsiders and upholding old-fashioned gender roles”^{Footnote 22}. These circumstances and the political climate which resulted offered fertile ground for bot activity during the Brexit referendum.

The following analysis examines the activity of a botnet that tweeted the referendum by sourcing a range of user-generated and user-curated content featuring hyperpartisan reports. Thirty-nine Twitter hashtags clearly associated with the referendum campaign from April to August 2016^{Footnote 23} were analysed, which collectively amounted to 10 million tweets. Subsequently, the profiles of over 800,000 unique users were retrieved, and thresholding and filtering approaches were implemented to disentangle real users from bots. A combination of methods were used to identify a large group of bots whose accounts had been deactivated by the bot master or blocked/removed by Twitter in the aftermath of the referendum; identify the campaign associated with the tweets; retrieve the web page title of URLs embedded in tweets (when available); and examine retweet and @-mention behaviour.

Disappearing tweeters

From a total of 794,949 Twitter profiles that tweeted the Vote Leave and Vote Remain campaigns, five per cent were identified to have been deactivated, removed, blocked, set to private, or to have altered their username after the referendum. Of this group, the majority (66 per cent) had changed their username since the referendum but remained active on Twitter (repurposed or recycled accounts), and 34 per cent were suddenly blocked or had removed themselves from Twitter (deleted accounts). Common among recycled and removed accounts is the predominance of retweeted content that disappeared from the Internet shortly after the referendum. Another commonality is the notable support for the Vote Leave campaign, measured by the relative frequency of keywords and hashtags associated with each of the campaigns. While the total ratio of messages using hashtags that supported the Vote Leave and Vote Remain campaigns was 31 per cent and 11 per cent respectively, recycled and removed accounts combined tweeted the referendum hashtags to a ratio of 37 per cent and 17 per cent.

Analysing the language of the tweets provided additional insight into this disparity. By annotating tweets using textual markers such as hashtags and keywords associated with the Vote Leave and Vote Remain campaigns, the proportion of tweets supporting the Vote Leave campaign in the pool of removed accounts was yet higher, at 41 per cent compared with 31 per cent for active users, with the proportion of neutral tweets also being higher in the latter. Slogans associated with the Vote Leave campaign were also significantly more likely to have been tweeted by this pool of accounts in a ratio of eight to one. This subset of removed accounts was considerably more active in the period leading to the referendum, and also less active in the wake of the vote.

Hyperpartisan and hyperperishable news

Attempts to retrieve the web pages tweeted by recycled and removed accounts found that most tweeted URLs (55 per cent) no longer existed, could not be resolved, or linked to either a Twitter account or web page that no longer exists. Nearly one third (29 per cent) of the URLs link to Twitter statuses, pictures, or other multimedia content that is no longer available and whose original posting account has also been deleted or blocked, a marker of the perishable nature of digital content at the centre of political issues. Of this total, one per cent of all links was directed to user @brndstr, one of the few accounts appearing in the communication network of recycled accounts that remains active under the same username. This account is managed by a company which specialises in providing bots for social media campaigns.

A closer inspection of the accounts sourcing content to the pool of recycled and removed accounts reveals the markedly short shelf life of user-generated content. These are Twitter accounts invested in spreading dubious news stories sourced from a circuit of self-referencing blews: a combination of far-right weblogs and traditional tabloid media. However, the few retrieved web pages indicate that the content tweeted by this pool of recycled and removed accounts do not conform to the notion of disinformation or fake news. Instead, the content is in line with a form of storytelling that blurs the line between traditional tabloid journalism and user-generated content, which is often anonymous, fact-free, and with a strong emphasis on simplification and spectacularisation. User-generated content takes the lion’s share of hyperlinks tweeted by recycled and removed accounts, often presented as a professional newspaper via content curation services, and is likely to include Twitter multimedia.

Similarly, the few links that remained accessible six months after the referendum consisted of material rich in rumours, unconfirmed events and human-interest stories with an emotional and populist appeal that resembles tabloid journalism, with the added complexity that audiences play a pivotal role in curating and distributing the content. The inspected sources, though not representative of the much larger universe of content tweeted by this population of users (and which has unfortunately mostly vanished from Twitter), is much akin to hyperpartisan tabloid journalism, with a topical emphasis on highly-clickable, shareable and human-interest driven stories.

Although 17 per cent of weblinks pointed to Twitter accounts that are still active, an examination of a random sample shows that the original message is frequently no longer available, thus preventing any determination of the nature of the content originally tweeted. For example, one profile generated a cascade of several hundred retweets and was found to have an active posting user. Although the user account seeding the cascade remains active, the original tweet has been removed (together with the relevant retweet cascade). With Internet Archive having no record of this specific tweet, it is no longer possible to know what the original image conveyed. The scale of deleted content applies both to weblinks tweeted by this population as well as to user accounts, a worrying development given the importance and contentious nature of the referendum.

Brexit Botnet

Subsequent inspections surrounding the retweet behaviour of bots shed light on the existence of at least two clusters of fundamentally different bots. The first group was dedicated to replicating automated content, often hyperpartisan news, hence achieving a much faster cascade turnaround compared with active user-generated cascades. The second group was deeply embedded in human-driven activity. Both types of account succeeded at generating medium (S>50) and large cascades (S>100), but their typical retweeting patterns indicate they were created and deployed to meet fundamentally different objectives.

While the first subset of bots was associated with accounts that leveraged retweet behaviour to amplify the reach of a small set of users and rarely, if ever, started any cascade themselves, the other subset of bots had a narrower scope of operation, only retweeting other bots in the botnet and thereby producing many medium-sized cascades that spread significantly faster than the remainder of the cascades. Although both are bots, the first only retweets active users, whereas the retweet activity of the latter is restricted to other bots (likely deployed in conjunction with the head node). Each of the bot subnets plays a specialised role in the network, and both feed into the larger pool of regular accounts brokering information to @vote_leave, the official Twitter account of the Vote Leave campaign, and arguably the most prominent point of information diffusion associated with the Vote Leave.

Retweet activity was mostly concentrated in the period leading up to the referendum vote. Most of it consisted of organic retweets from and to accounts in the active user base. Bots operated in the same period both by retweeting active users and retweeting other bots, mainly in the week preceding the vote and on the eve of the referendum, when a peak in retweet activity between bots was observed. There was a sharp decline in retweet activity after the referendum, mainly among active users who ceased to trigger or join retweet cascades. Bots remained operational throughout the campaign and activity peaks were observed in the period from 12 to 15 July: first retweeting active users, then replicating bot content, only to tail off in the following weeks when the botnet was retired, deactivated, or removed entirely from the Twitter platform^{Footnote 24}. In fact, head nodes of the bot-to-bot subnet mostly disappeared after the referendum. This is the critical period when content tweeted by such bots and the web pages linked to their tweets disappeared from the Internet, Twitter public, and enterprise application programming interfaces (APIs).

Conclusions

The large number of links directed to user-generated content, particularly Twitter multimedia and the significant incidence of content curation services used to render socially shared content into professionally-looking online newspapers suggests that the universe of hyperpartisan news is both engineered top-down and reliant on user-generated content. While the content tweeted on Brexit has a stronger slant towards nationalist and nativist values compared to the content tweeted by the global population (27 per cent versus 19 per cent, respectively), the emerging reality of hyperpartisan web sites is that they cater to both extremes of the political spectrum, are often owned by the same companies, and repurpose stories to accommodate and confirm readership bias.

Analyses of the Brexit botnet did not find strong evidence of widespread ‘fake news’ dispersion, but rather surfaced the strategic placement of bots to feed user-curated, hyperpartisan information. The results presented in this study point to another milestone in tabloid journalism: the ability to incorporate an audience feedback loop while transitioning from the editorial identity of traditional tabloid newsprint to content curation that is both user-generated and created by editorial staff. Hyperpartisan news outlets thus epitomise the ongoing trend to churn out viral content that is mostly short, highly visual, shareable, accessed through mobile devices, and that, by confirming audience bias, sits side by side with the balkanisation of readership according to interests of like-minded groups.